[self-care:open-source-failures] Fix repeated live-mode target authority precompute failures in gh-aw-cao

Repeated live-mode precompute failures are blocking four `githubnext/gh-aw-cao` workflows before activation. In the bounded snapshot, 20 runs across `AW Doctor / Compiler Security`, `AW Doctor / Failures`, `AW Doctor / Upgrade`, and `Dependabot / Release Trains` failed with the same message: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`.

**Action:** CAO maintainers should fix the target-authority configuration for `githubnext/gh-aw-cao` live-mode runs; accept when a fresh run of each affected workflow passes pre-activation without the target-authority error.

The evidence supports a shared configuration problem affecting every cited workflow, not separate per-workflow defects. Because the same explicit precompute message recurs across multiple workflows, this is a P1 control-plane configuration issue with high confidence.

Recommended bounded fix

- Verify that `.github/workflows/cao.json` is present on the target repository default branch.
- Confirm it grants the required target authority for the affected live packages.
- Re-run one workflow from each affected family to confirm the precompute gate clears.

Representative runs

- `AW Doctor / Compiler Security` — https://github.com/githubnext/gh-aw-cao/actions/runs/33967261580
- `AW Doctor / Failures` — https://github.com/githubnext/gh-aw-cao/actions/runs/33967257198
- `AW Doctor / Upgrade` — https://github.com/githubnext/gh-aw-cao/actions/runs/33967251980
- `Dependabot / Release Trains` — https://github.com/githubnext/gh-aw-cao/actions/runs/33966283980

Observed recurrence in bounded snapshot: 20 runs.
Confidence: high.
Probable cause: missing or ineffective target-authority declaration for live mode.

Agent prompt

Inspect the live-mode authority configuration for `githubnext/gh-aw-cao`. Verify that `.github/workflows/cao.json` exists on the default branch and grants the correct target authority for `AW Doctor / Compiler Security`, `AW Doctor / Failures`, `AW Doctor / Upgrade`, and `Dependabot / Release Trains`. If the declaration is missing or malformed, prepare the minimal fix and explain how you verified that fresh workflow runs clear the `Target authority missing` precompute error.

### Control Plane
- Correlation ID: `33968361820-222`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33968361820

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33968569409) · pi · gpt54 · 18.8 AIC · ⌖ 8.62 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 1:25 PM UTC

Inspect .github/workflows/cao.json on the githubnext/gh-aw-cao default branch and compare its target-authority declaration with the four affected workflows. Start with the representative failed runs and verify the required live packages are covered. Done means fresh runs of AW Doctor / Compiler Security, AW Doctor / Failures, AW Doctor / Upgrade, and Dependabot / Release Trains pass pre-activation without the target-authority error.

Written by the indexing model from the issue text.